1. 05 Jul, 2019 1 commit
  2. 01 Jul, 2019 1 commit
  3. 23 May, 2019 2 commits
  4. 03 May, 2019 2 commits
  5. 02 May, 2019 1 commit
  6. 12 Apr, 2019 1 commit
  7. 18 Mar, 2019 2 commits
  8. 25 Feb, 2019 1 commit
  9. 08 Feb, 2019 1 commit
  10. 02 Nov, 2018 1 commit
  11. 22 Oct, 2018 1 commit
  12. 18 Oct, 2018 2 commits
  13. 16 Oct, 2018 1 commit
  14. 12 Oct, 2018 1 commit
  15. 21 Sep, 2018 1 commit
  16. 23 Jul, 2018 2 commits
  17. 19 Jul, 2018 1 commit
    • Sigurd Schneider's avatar
      Revert "[turbofan] Inline Number constructor in certain cases" · c7a9af61
      Sigurd Schneider authored
      This reverts commit 9eca23e9.
      
      Reason for revert: Clusterfuzz correctness issue
      
      Original change's description:
      > [turbofan] Inline Number constructor in certain cases
      > 
      > This CL adds inlining for the Number constructor if new.target is not
      > present. The lowering is BigInt compatible, i.e. it converts BigInts to
      > numbers.
      > 
      > Bug: v8:7904
      > Change-Id: If03b9f872d82e50b6ded7709069181c33dc44e82
      > Reviewed-on: https://chromium-review.googlesource.com/1118557
      > Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
      > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
      > Reviewed-by: Georg Neis <neis@chromium.org>
      > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#54454}
      
      TBR=jarin@chromium.org,neis@chromium.org,sigurds@chromium.org,bmeurer@chromium.org
      
      # Not skipping CQ checks because original CL landed > 1 day ago.
      
      Bug: v8:7904
      Change-Id: Ie5fa6c1262b8acc33edb672a0124f4458fcded86
      Reviewed-on: https://chromium-review.googlesource.com/1142777Reviewed-by: 's avatarSigurd Schneider <sigurds@chromium.org>
      Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#54544}
      c7a9af61
  18. 16 Jul, 2018 1 commit
  19. 23 Jun, 2018 1 commit
  20. 15 Jun, 2018 1 commit
  21. 28 Apr, 2018 1 commit
  22. 16 Mar, 2018 1 commit
    • Benedikt Meurer's avatar
      [turbofan] Remove unsound SeqString types. · 36426ab7
      Benedikt Meurer authored
      A value of type OtherSeqString can change its type to OtherNonSeqString
      via inplace internalization (and redirection via a ThinString). This can
      lead to out of bounds memory accesses and generally correctness bugs, as
      seen with crbug.com/822284.
      
      This change might affect performance in some cases, and we'll need to
      evaluate whether it's worth spending cycles on adding another mechanism
      that leverages the sequential string information in a safe way on a case
      by case basis.
      
      Bug: chromium:822284
      Change-Id: I0de77ec089a774236555f38c365f7548f454edfe
      Reviewed-on: https://chromium-review.googlesource.com/966021Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
      Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#51975}
      36426ab7
  23. 23 Feb, 2018 3 commits
  24. 15 Jan, 2018 1 commit
  25. 11 Jan, 2018 1 commit
  26. 04 Jan, 2018 1 commit
  27. 27 Dec, 2017 1 commit
  28. 21 Dec, 2017 1 commit
    • Caitlin Potter's avatar
      [turbofan] Reduce ArrayIteratorNext based on instance type · dcd60e8c
      Caitlin Potter authored
      NodeProperties::InferReceiverMaps now traverses effect chain for
      Loop-EffectPhi nodes, which makes it possible to inline `iterator.next()`
      within a loop when the next property is loaded outside of a loop.
      
      A new helper, GetInstanceTypeWitness(), performs InferReceiverMaps() and
      checks that each resulting map has an identical instance type.
      
      BUG=chromium:795632, v8:5940, v8:3018
      R=bmeurer@chromium.org, jarin@chromium.org
      
      Change-Id: Id2690c224668bea62dbcad62ebc2bdf7e37e80d3
      Reviewed-on: https://chromium-review.googlesource.com/837484
      Commit-Queue: Caitlin Potter <caitp@igalia.com>
      Reviewed-by: 's avatarBenedikt Meurer <bmeurer@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#50284}
      dcd60e8c
  29. 29 Nov, 2017 1 commit
    • Benedikt Meurer's avatar
      [turbofan] Unify CanBePrimitive and NeedsConvertReceiver. · 9fb39c6b
      Benedikt Meurer authored
      The two helper functions CanBePrimitive and NeedsConvertReceiver did
      essentially the same, just in a slightly different way, and both weren't
      really robust wrt. to the list of JSConstruct* and JSCreate* operators
      that they were handling. There's now a single helper in the
      NodeProperties and a couple of extra macro lists to keep this list up
      to date more easily.
      
      Drive-by-fix: Also moved the CanBeNullOrUndefined helper to the
      NodeProperties class.
      
      Bug: v8:5267, v8:7109
      Change-Id: Ibbf387040e3f424ee224c53fac15c2b3207b1926
      Reviewed-on: https://chromium-review.googlesource.com/793734Reviewed-by: 's avatarYang Guo <yangguo@chromium.org>
      Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#49695}
      9fb39c6b
  30. 03 Nov, 2017 1 commit
  31. 27 Oct, 2017 1 commit
  32. 20 Oct, 2017 1 commit
  33. 19 Oct, 2017 1 commit
    • Jaroslav Sevcik's avatar
      Revert "[turbofan] Load elimination prunes control flow based on instance type." · 8f09a751
      Jaroslav Sevcik authored
      This reverts commit 71bcc1d9.
      
      Reason for revert: Regresses Octane/Box2D, among other things.
      
      Original change's description:
      > [turbofan] Load elimination prunes control flow based on instance type.
      > 
      > Changes:
      > - introduce the notion of unreachable abstract states.
      > 
      > - reconnect unreachables states to runtime abort in effect phis (so that
      >   the merged states are not polluted by unreachable branches while
      >   preserving SSA).
      > 
      > - mark states with failed map checks, unreachable map guars as unreachable.
      > 
      > - add instance type to AbstractMaps, only invalidate instance type on
      >   mismatched effect merges.
      > 
      > 
      > This results in 2-3% improvement on ARES/ML steady state.
      > 
      > Bug: v8:6396
      > Change-Id: I35b0d4482fa400ba7ee9a754f8ef1b2663ebc7dc
      > Reviewed-on: https://chromium-review.googlesource.com/727761
      > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
      > Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#48742}
      
      TBR=jarin@chromium.org,bmeurer@chromium.org
      
      Change-Id: I6302b37dbf5ea781c64815ef1900681531ad7d71
      No-Presubmit: true
      No-Tree-Checks: true
      No-Try: true
      Bug: v8:6396
      Reviewed-on: https://chromium-review.googlesource.com/728440Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
      Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#48763}
      8f09a751